Methods and devices to efficiently determine node delay in a communication network

ABSTRACT

A network monitoring device monitors at least one tap point corresponding to a network interface between User Equipment (UE) and one or more additional nodes in the communication network, detects one or more transactions at the at least one tap point corresponding to the network interface with each transaction including request data and response data. The network monitoring device further determines a time associated with the request data and a time associated with the response data for each transaction, determines a delay time for each transaction for the at least one tap point by a difference between the time associated with the request data and the time associated with the response data, assigns the delay time for each transaction to one or more a predefined time ranges, and increments a count corresponding to the one or more predefined time ranges when the delay time is assigned.

BACKGROUND

1. Field of the Invention

The present disclosure relates to network monitoring, and moreparticularly, to efficiently determining network delay.

2. Description of the Related Art

Traditionally, mobile communication networks such as Global System forMobile Communications (GSM) network employed circuit switchingarchitectures and technologies whereby hardware circuits establishconnections between a calling and a called party throughout the network.This circuit switching architecture was improved upon by a GeneralPacket Radio Service (GPRS) network architecture, which incorporatedpacket-switching technologies to transport data as packets without theestablishment of dedicated circuits. A 3rd Generation PartnershipProject (3GPP) organization improved upon the GPRS architecture andprovided guidelines for implementing new system topologies for a 3GPPmobile communication network. The GPP community particularly modeled itsnetwork on IP (Internet Protocol) based routing techniques and isgenerally referred to as Evolved 3GPP Packet Switched Domain—also knownas the Evolved Packet System (EPS).

When designing, maintaining, and/or operating any communicationnetwork—e.g., GSM networks, GPRS networks, EPS networks, and thelike—data flows are monitored and analyzed to provide important insightinto potential network problems as well as provide insight into acurrent state of the network (e.g., Quality of Service parameters,etc.). Such network monitoring is used to address existing networkproblems as well as to improve overall network design.

However, with an increasingly large consumer adoption of mobile devices,the amount of network data to be monitored quickly becomes unwieldy andproves expensive both in terms of hardware support and also in terms ofresource usage. For example, some conventional network monitoringtechniques require, in part, end-to-end data correlation of incomingdata packets with outgoing data packets for a node or network interfaceand typically requires a large amount of network resources (e.g.,dedicated network monitoring resources or otherwise). Further, theconventional monitoring techniques indicate network delay at a very highlevel and fails to provide meaningful insight into specific targetlocations where delay occurs. Such high level delay is furthercomplicated by Diameter Routing Agents (DRAs), which were introduced toensure that messages are routed among the correct nodes for theincreasingly complex LTE networks. DRAs potentially introduce delay atspecific network locations, which prove hard to detect usingconventional monitoring techniques. Accordingly, despite suchconventional efforts, a need remains to provide efficient networkmonitoring techniques that identify delay on a granular scale.

SUMMARY

As discussed herein, the network monitoring techniques, includingdevices and systems employing the same, determine network delay as afunction of separate transactions for various network tap points. Anetwork monitoring device or system monitors various network tap pointsfor network interfaces located at ingress and egress sides ofcorresponding network nodes in a communication network such as a 3GPPLong Term Evolution (LTE) network. In operation, the network monitoringdevice captures network traffic such as request and response messagesfor a transaction and determines delay specific to each tap point. Suchtechniques obviate the need for end-to-end data correlation and providegranular delay statistics for each tap point and corresponding networknode.

More specifically, in one or more exemplary embodiments, a networkmonitoring device monitors at least one tap point corresponding to anetwork interface between User Equipment (UE) and one or more additionalnodes in the communication network. For example, the nodes can includean Evolved Node B (eNB), a Mobility Management Entity (MME) node, aServing Gateway (SGW) node, a Packet data Network Gateway (PGW) node,and a Serving General Packet Radio Service (GPRS) Support Node (SGSN).The network monitoring device further detects one or more transactionsat the at least one tap point corresponding to the network interface.For example, the network monitoring device may correlate the requestdata with the response data for the transaction based on at least one ofa sequence number and a transaction identifier to yield a transaction.In certain embodiments, the network monitoring device further classifieseach transaction of the one or more transactions as at least one of aningress transaction or an egress transaction based on an InternetProtocol (IP) source address of the request data and the response data.The network monitoring device determines a time associated with therequest data and a time associated with the response data for eachtransaction and a delay time for each transaction—e.g., by a differencebetween the time associated with the request data and the timeassociated with the response data. The network monitoring device assignsthe delay time for each transaction to one or more a predefined timeranges and increment a count corresponding to the one or more predefinedtime ranges when the delay time is assigned.

In certain embodiments, the network monitoring device compiles the countcorresponding to each predefined time range for each tap point into oneor more diagrams. Moreover, the count may be compiled when, for example,the count exceeds a threshold value, according to a preset schedule,etc. The diagrams can include bar graphs, histograms, pie-charts, andline-diagrams. Such diagrams are further provided to a display device tocause the display device to provide meaningful insight for network delayfor particular nodes, network interfaces, and the like.

In certain other embodiments, the network monitoring device monitors atap point corresponding to different nodes and compares the delay timefor each transaction at each node to determine if one or more of thenodes has an issue. For example, a large increase in average delay for aparticular node as compared to an upstream node (ingress side) ordownstream node (egress side), may be indicative of an issue at the nodeand/or at one of the node network interfaces. Such an issue is flaggedand/or otherwise indicated to a network operator.

These and other features of the systems and methods of the subjectinvention will become more readily apparent to those skilled in the artfrom the following detailed description of the preferred embodimentstaken in conjunction with the drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

So that those skilled in the art to which the subject inventionappertains will readily understand how to make and use the devices andmethods of the subject invention without undue experimentation,preferred embodiments thereof will be described in detail herein belowwith reference to certain figures, wherein:

FIG. 1 illustrates an example communication network;

FIG. 2 illustrates a portion of the example communication network shownin FIG. 1, showing a network monitoring device and message flow betweenUser Equipment (UE) and an external network; n example communicationnetwork;

FIG. 3 illustrates an example network device/node;

FIG. 4A illustrates an example chart, showing ingress delay from a nodein the network shown in FIG. 1;

FIG. 4B illustrates another example chart, showing egress delay from anode in the network shown in FIG. 1; and

FIGS. 5A-5B illustrate an example simplified procedure for determiningnetwork delay, particularly from the perspective of the networkmonitoring node shown in FIG. 2.

A component or a feature that is common to more than one drawing isindicated with the same reference number in each of the drawings.

DESCRIPTION OF EXAMPLE EMBODIMENTS

As discussed above, the 3rd Generation Partnership Project (3GPP)organization specifies the architecture for various mobile cellularnetworks. The latest mobile network architecture defined by the 3GPP iscalled Evolved 3GPP Packet Switched Domain—also known as the EvolvedPacket Core (EPC).

FIG. 1 illustrates an example communication network, particularlyshowing various components of the 3GPP EPC network 100. As shown, the3GPP EPC network 100 operatively transmits data packets between anattached User Equipment (UE) 120 and an external network 105—i.e., theInternet. Disposed between UE 120 and the external network 105 arenetwork nodes that perform specific functions. Such network nodesinclude, for example, evolved nodeB(s) 115 (which form part of RadioAccess Networks RANs towers), a Serving Gateway (SGW) node 107, and aPacket Data Network Gateway (PGW) node 110. Further, network 100includes a Mobility Management Entity (MME) node 120, a Home SubscriberServer (HSS) node 122, and a Serving General Packet Radio Service Node(SGSN) 115. The view shown in FIG. 1 is for exemplary purposes only, andadditional nodes/devices can be included or excluded as appreciated byone skilled in the art.

Notably, SGSN 115 generally supports legacy Global System for Mobile(GSM) network components as well as the GPRS Tunneling Protocol (GTP),which communicates data amongst GPRS Support Nodes (GSNs) (not shown).In the GSM context, SGSN 115 is responsible for the delivery of datapackets from and to the mobile stations within its geographical servicearea, including packet routing and transfer, mobility management(attach/detach and location management), logical link management, andauthentication and charging functions.

MME node 120 is generally a control-node typically responsible for idlemode UE paging and tagging procedure including retransmissions. It isinvolved in data bearer activation/deactivation processes and is alsoresponsible for choosing a corresponding SGW node for UE at the initialattach. MME node 120 is also responsible for authenticating the user (byinteracting with HSS node 122, which contains user-related andsubscription-related information). MME node 120 also provides thecontrol plane function for mobility between Long Term Evolution (LTE)networks and GSM networks supported by SGSN 115. Network interfacesbetween MME node 120 and SGSN include the S3 interface, and networkinterfaces between MME node 120 and the HHS (for roaming UE) includesthe S6a interface.

SGW node 107 generally routes and forwards user data packets andperforms mobility anchoring for the user plane during inter-eNodeBhandovers and as an anchor for mobility between LTE and other 3GPPtechnologies (e.g., terminating S4 interface and relaying the trafficbetween 2G/3G systems and PGW). For idle state UEs, SGW node 107terminates the downlink data path and triggers paging when downlink dataarrives for the UE. SGW node 107 particularly manages and stores UEcontexts (e.g. parameters of the IP bearer service, network internalrouting information, etc.).

PGW node 110 generally provides connectivity from UE 120 to externalpacket data networks 105 (e.g., the Internet) and is a point of exit andentry of traffic for UE 120. Notably, PGW node 110 performs UE IPaddress allocation and packet filtering (e.g. deep packet inspection,packet screening) in order to map UE 120 traffic to appropriate Qualityof Service (QoS) level. PGW node 110 also performs the function of ahome agent for MIPv6 (Mobile IPv6) based mobility management, or thefunction of a Local Mobility Anchor when Proxy MIPv6 protocols are usedfor mobility management.

FIG. 2 illustrates a portion of the example communication network shownin FIG. 1, showing a network monitoring device 205 and message flowbetween User Equipment (UE) 120 and external network 105. Operationally,UE 120 sends a data request 213 (e.g., a data packet) toward theexternal network 105. Data request 213 is routed through network 100using Internet Protocol (i.e., packet switching) including throughnetwork nodes SGW node 107 and PGW node 110 and corresponding networkinterfaces. Data request 213 is processed by the external network 105(e.g., by nodes/devices of the external network) and a resultantresponse 217 is transmitted to UE 120, again routed through network 100similar to data request 213. An aggregate delay can be determined for UE120 as a time difference between the time (T₀) request 215 istransmitted and the time (T_(d)) response 220 is received. However, thisaggregate delay time provides a broad picture of total network delay andproves expensive in terms of hardware as well as network resource usage(e.g., requiring end-to-end data correlation). As discussed above, suchaggregate delay time further fails to appreciate delays introduced byparticular nodes or corresponding network interfaces.

As discussed herein, the network monitoring techniques (andsystems/devices employing the same) determine network delay as afunction of separate transactions and at separate network tap points. Inparticular, still referring to FIG. 2, a network monitoring system,monitors various network tap points, labeled as T1-T4, for networkinterfaces located at ingress and egress sides of corresponding networknodes. For example, as used herein, ingress messages, relative to anode, include a destination IP address matching the IP address of thenode since the ingress message will be inbound or incoming relative tothe node (e.g., in packet switched networks). In contrast, egressmessages, relative to the node, include a source IP address matching theIP address of the node since the egress message will be sent from thenode (e.g., the message will appear to be originating from the node inpacket-switched networks relative to the next-hop node). Transactions,such as “Transaction at T1” and “Transaction at T2” include ingress andegress messages relative to a node—here, SGW 107. Determining if amessage is ingress or egress relative to the node is determined bymatching destination and source IP addresses between the message and theIP address of SGW 107. Operatively, network monitoring system 205captures network traffic, including request and response messages (e.g.,request 215 and response 220) for each transaction and computes delayspecific to each tap point T1-T4 (and relative to ingress/egress forcorresponding nodes), as discussed in greater detail below.

Referring now to FIG. 3, a schematic block diagram of an examplenode/device 300 used with one or more embodiments described herein,e.g., as network monitoring system 205 and/or a device within networkmonitoring system 205. The device 300 comprises one or more networkinterfaces 310, at least one hardware processor 320 (e.g., amicrocontroller), and a memory 340 interconnected by a system bus 350.

The network interface(s) 310 contain the mechanical, electrical, andsignaling circuitry for communicating data over physical and/or wirelesslinks coupled to the network 100 (e.g., by tap points 210). The networkinterfaces may be configured to transmit and/or receive data using avariety of different communication protocols, including, inter alia,TCP/IP, UDP, wireless protocols (e.g., IEEE Std. 802.15.4, WiFi,Bluetooth®), Ethernet, powerline communication (PLC) protocols, etc.

The memory 340 comprises a plurality of storage locations that areaddressable by the processor 320 and the network interfaces 310 forstoring software programs and data structures associated with theembodiments described herein. As noted above, certain devices may havelimited memory or no memory (e.g., no memory for storage other than forprograms/processes operating on the device). The processor 320 maycomprise necessary elements or logic adapted to execute the softwareprograms and manipulate data structures 345, such as routes or prefixes(notably on capable devices only). An operating system 342, portions ofwhich are typically resident in memory 340 and executed by theprocessor, functionally organizes the device by, inter alia, invokingoperations in support of software processes and/or services executing onthe device. These software processes and/or services may comprisenetwork monitoring process/services 344. It will be apparent to thoseskilled in the art that other processor and memory types, includingvarious computer-readable media, may be used to store and executeprogram instructions pertaining to the techniques described herein.Also, while the description illustrates various processes, it isexpressly contemplated that various processes may be embodied as modulesconfigured to operate in accordance with the techniques herein andwithin a distributed processing architecture (e.g., according to thefunctionality of a similar process).

Network monitoring process (services) 344 contains computer executableinstructions executed by the processor 320 to perform functions,including packet sniffing, detection, interception, and the like, aswill be understood by those skilled in the art. Illustratively, thetechniques described herein may be performed by hardware, software,and/or firmware, such as in accordance with the network monitoringprocess 344, which may contain computer executable instructions executedby the processor 320 (or independent processor of interfaces 310) toperform functions relating to the techniques described herein.

Referring again to FIG. 2, the network monitoring system 205, executesthe network monitoring process 344, and determines network delay as afunction of separate transactions at each network tap point T1-T4. Forexample, depending on the protocol, the network monitoring system 205detects data packets for a transaction by correlating request data withresponse data based on a sequence number, a transaction identifier, etc.Network monitoring system 205 further associates a time stamp with eachof the request data and the response data (e.g., when the data isreceived by network monitoring system 205). Delay time for transactionsat a tap point is determined as the difference between the time stampassociated with the request data and the time associated with theresponse data.

In certain embodiments, the network monitoring system 205 assigns thedetermined delay time for each transaction at a tap point to one or morepredefined time ranges and increments a count corresponding to each timerange. Alternatively, the delay time for each transaction can bemaintained independently. The delay time, either aggregated according totime ranges or independently maintained, is reported to a networkoperator. Preferably, the network monitoring system 205 reports the timedelays for corresponding network taps at scheduled time intervals (e.g.,every minute, hour, day, etc.). This way, a network operator can garnermeaningful insight into network operations such as delay time for eachnetwork tap point (corresponding to ingress or egress side networkinterfaces for network nodes).

In preferred embodiments, the delay time is reported to a networkoperator using one or more charts, diagrams, graphs and the like. Forexample, FIG. 4A is a histogram chart 400 showing ingress delay from SGWnode 107 for transactions monitored at tap point T1 and FIG. 4B is ahistogram chart 401, showing egress delay from SGW node 107 fortransactions monitored at tap point T2. A network operator can quicklyscan such charts to efficiently identify and troubleshoot excessivenetwork delays at particular network nodes, tap points, networkinterfaces, etc. For example, a network operator looking at FIG. 4A canquickly determine there is a high frequency of large delay time for theingress side of SGW node 107 and begin troubleshooting processes. It isappreciated that the delay time determined at each tap point (forrespective ingress sides or egress sides of network nodes) can bepresented in any number of ways to a network operator and that FIGS.4A-4B are merely exemplary charts for purposes of discussion, notlimitation. For example, charts can include multiple nodes (ingressside, egress side, combinations thereof, etc.) and present suchinformation so a network operator can quickly compare nodal networkdelays and identify issues with excessive delay at a particular node,interface, tap point, etc.

FIGS. 5A-5B illustrate an example simplified procedure 500 formonitoring network delay, particularly from the perspective of networkmonitoring system 205, in accordance with one or more embodimentsdescribed herein.

Referring to FIG. 5A, procedure 500 begins at step 505 and continues tostep 510 where, as discussed above, the network monitoring systemmonitors at least one tap point corresponding to a network interfacebetween User Equipment (UE) and one or more additional nodes in thecommunication network (e.g., a 3GPP Long Term Evolution (LTE) network,etc.). These nodes can include, for example, an Evolved Node B (eNB), aMobility Management Entity (MME) node, a Serving Gateway (SGW) node, aPacket data Network Gateway (PGW) node, and a Serving General PacketRadio Service (GPRS) Support Node (SGSN). Next, in step 515, the networkmonitoring system detects one or more transactions at the at least onetap point corresponding to the network interface. For example, thenetwork monitoring system correlates request data with response data ofthe transaction (depending on the protocol) based on at least one of asequence number and a transaction identifier, etc. Further, in step 520,the network monitoring system classifies each transaction as, forexample, an ingress transaction or an egress transaction based on anInternet Protocol (IP) source address of the request data and theresponse data. A time stamp, e.g., upon receipt, is associated with therequest data and the response data for each transaction in step 525, andin step 530, the network monitoring system determines a delay time foreach transaction for the tap point by a difference between the timeassociated with the request data and the time associated with theresponse data.

Procedure 500 continues to FIG. 5B, where, for certain embodiments,delay time for each transaction is assigned to one or more a predefinedtime ranges shown in step 535. In such embodiments, the networkmonitoring system increments, in step 540, a count corresponding to theone or more predefined time ranges when the delay time is assigned.Further, the network monitoring system compiles, in step 545, the countcorresponding to each predefined time range for each tap point into oneor more diagrams (e.g., bar graphs, histograms, pie-charts,line-diagrams, etc.). Optionally, in step 545, the network monitoringnode compiles the count for the predefined time range for each tap pointwhen the count exceeds a threshold value (e.g., a minimum count, amaximum count, etc.). In step 550, the network monitoring node providesthe one or more diagrams to a display device to cause the display deviceto display the one or more diagrams (e.g., to a network operator).

In certain other embodiments, the network monitoring system compares thedelay time for each transaction at various tap points (e.g., ingressside or egress side) to determine that at least one network node has anissue (step 555) and indicates the issue to a network operator (step560).

Procedure 500 subsequently ends at step 565, but may begin again at step510 where the network monitoring node monitors the tap point(s).

It should be noted that while certain steps within procedure 500 may beoptional as described above, the steps shown in FIG. 5 are merelyexamples for illustration, and certain other steps may be included orexcluded as desired. Further, while a particular order of the steps isshown, this ordering is merely illustrative, and any suitablearrangement of the steps may be utilized without departing from thescope of the embodiments herein.

The techniques described herein, therefore, provide for efficientnetwork delay monitoring amongst various network nodes, interfaces, andthe like. In particular, the techniques herein significantly reduce theprocessing time to determine delay and obviate the need to determineend-to-end data correlation. Moreover, using these techniques, agranular delay time is determined at each tap point and provides anetwork operator valuable information used when troubleshooting issues.

While there have been shown and described illustrative embodiments thatprovide for determining network delay, it is to be understood thatvarious other adaptations and modifications may be made within thespirit and scope of the embodiments herein. For example, the embodimentshave been shown and described herein with relation to 3GPP LTE networksand particular protocols. However, the embodiments in their broadersense are not as limited, and may, in fact, be used with other types ofnetworks and/or protocols.

The foregoing description has been directed to specific embodiments. Itwill be apparent, however, that other variations and modifications maybe made to the described embodiments, with the attainment of some or allof their advantages. For instance, it is expressly contemplated that thecomponents and/or elements described herein can be implemented assoftware being stored on a tangible (non-transitory) computer-readablemedium (e.g., disks/CDs/RAM/EEPROM/etc.) having program instructionsexecuting on a computer, hardware, firmware, or a combination thereof.Accordingly this description is to be taken only by way of example andnot to otherwise limit the scope of the embodiments herein. Therefore,it is the object of the appended claims to cover all such variations andmodifications as come within the true spirit and scope of theembodiments herein.

What is claimed is:
 1. A method for measuring delay in a communicationnetwork, comprising: monitoring, by a network monitoring node, at leastone tap point corresponding to a network interface between UserEquipment (UE) and one or more additional nodes in the communicationnetwork, wherein the at least one tap point comprises at least a firsttap point and a second tap point, the first tap point and the second tappoint corresponding to first and second network nodes of the additionalnodes, wherein the first tap point includes a first tap location at aningress side of the first network node and a second tap location at anegress side of the first network node, and the second tap point includesa third tap location at an ingress side of the second network node and afourth tap location at an egress side of the second network node;detecting, by the network monitoring node, one or more transactions atthe at least one tap point corresponding to the network interface, eachtransaction including request data and response data; classifying, bythe network monitoring node, each transaction detected at the respectiveat least one tap point as an ingress or egress transaction relative tothe node that corresponds to the tap point; determining, by the networkmonitoring node, a time associated with the request data and a timeassociated with the response data for each transaction as classified;determining, by the network monitoring node, a delay time for eachtransaction as classified, for each of the ingress and egress side ofthe at least one tap point by a difference between the time associatedwith the request data and the time associated with the response data;assigning, by the network monitoring node, the delay time for eachtransaction as classified, for each of the ingress and egress side ofthe at least one tap point to one or more predefined time ranges;incrementing, by the network monitoring node, a count corresponding tothe one or more predefined time ranges when the delay time is assigned;comparing, by the network monitoring node, the delay time for eachtransaction as classified at the first tap point to the delay time foreach transaction as classified at the second tap point to determine thata particular network node of the first and second network nodes has anissue associated with an excessive delay; and indicating, by the networkmonitoring node, the issue to a network operator, responsive todetecting the issue.
 2. The method of claim 1, wherein the one or moreadditional nodes comprises at least one of an Evolved Node B (eNB), aMobility Management Entity (MME) node, a Serving Gateway (SGW) node, aPacket data Network Gateway (PGW) node, and a Serving General PacketRadio Service (GPRS) Support Node (SGSN).
 3. The method of claim 1,further comprising: compiling, by the network monitoring node, prior tocomparing the delay time, the count corresponding to each predefinedtime range for each tap point into one or more diagrams; and providing,by the network monitoring node, the one or more diagrams to a displaydevice to cause the display device to display the one or more diagrams.4. The method of claim 3, wherein the network monitoring node compilesthe count corresponding to each predefined time range for each tap pointinto the one or more diagrams when the count exceeds a threshold value.5. The method of claim 3, wherein the one or more diagrams includes atleast one of bar graphs, histograms, pie-charts, and line-diagrams. 6.The method of claim 1, wherein detecting the one or more transactions atthe at least one tap point corresponding to the network interfacefurther comprises: correlating, by the network monitoring node, therequest data with the response data for the transaction based on atleast one of a sequence number and a transaction identifier.
 7. Themethod of claim 1, wherein, classifying each transaction, by the networkmonitoring node, is performed after detecting the one or moretransactions, based on an Internet Protocol (IP) source address of therequest data and the response data.
 8. The method of claim 1, whereineach of the first tap point and the second tap point further correspondto one of an ingress side or an egress side of the correspondingdifferent network nodes.
 9. The method of clam 1, wherein thecommunication network is a Long Term Evolution (LTE) network.
 10. Anetwork monitoring device, comprising: one or more network interfacesadapted to communicate in a communication network; a hardware processoradapted to execute one or more processes; and a memory configured tostore a process executable by the processor, the process when executedoperable to: monitor at least one tap point corresponding to a networkinterface between User Equipment (UE) and one or more additional nodesin the communication network, wherein the at least one tap pointcomprises at least a first tap point and a second tap point, the firsttap point and the second tap point corresponding to first and secondnetwork nodes of the additional nodes, wherein the first tap pointincludes a first tap location at an ingress side of the first networknode and a second tap location at an egress side of the first networknode, and the second tap point includes a third tap location at aningress side of the second network node and a fourth tap location at anegress side of the second network node; detect one or more transactionsat the at least one tap point corresponding to the network interface,each transaction including request data and response data; classify eachtransaction detected at the respective at least one tap point as aningress or egress transaction relative to the node that corresponds tothe tap point; determine a time associated with the request data and atime associated with the response data for each transaction asclassified; determine a delay time for each transaction as classifiedfor each of the ingress and egress side of the at least one tap point bya difference between the time associated with the request data and thetime associated with the response data; assign the delay time, for eachtransaction as classified, for each of the ingress and egress side ofthe at least one tap point to one or more predefined time ranges;increment a count corresponding to the one or more predefined timeranges when the delay time is assigned; compare the delay time for eachtransaction as classified at the first tap point to the delay time foreach transaction as classified at the second tap point to determine thata particular network node of the first and second network nodes has anissue associated with an excessive delay; and indicate the issue to anetwork operator, responsive to detecting the issue.
 11. The networkmonitoring device of claim 9, wherein the one or more additional nodescomprises at least one of an Evolved Node B (eNB), a Mobility ManagementEntity (MME) node, a Serving Gateway (SGW) node, a Packet data NetworkGateway (PGW) node, and a Serving General Packet Radio Service (GPRS)Support Node (SGSN).
 12. The network monitoring device of claim 10,wherein the process, when executed is further operable to: compile,prior to comparing the delay time, the count corresponding to eachpredefined time range for each tap point into one or more diagrams; andprovide the one or more diagrams to a display device to cause thedisplay device to display the one or more diagrams.
 13. The networkmonitoring device of claim 12, wherein the network monitoring devicecompiles the count corresponding to each predefined time range for eachtap point into the one or more diagrams when the count exceeds athreshold value.
 14. The network monitoring device of claim 12, whereinthe one or more diagrams includes at least one of bar graphs,histograms, pie-charts, and line-diagrams.
 15. The network monitoringdevice of claim 10, wherein when the network monitoring device detectsthe one or more transactions at the at least one tap point correspondingto the network interface, the network monitoring device further:correlates the request data with the response data for the transactionbased on at least one of a sequence number and a transaction identifier.16. The network monitoring device of claim 10, wherein classifying eachtransaction is performed after detecting the one or more transactions,based on an Internet Protocol (IP) source address of the request dataand the response data.
 17. The network monitoring device of claim 10,wherein each of the first tap point and the second tap point furthercorrespond to one of an ingress side or an egress side of thecorresponding different network nodes.
 18. The network monitoring deviceof claim 10, wherein the communication network is a Long Term Evolution(LTE) network.
 19. A tangible, non-transitory, computer-readable mediahaving software encoded thereon, the software, when executed by aprocessor, operable to: monitor at least one tap point corresponding toa network interface between User Equipment (UE) and one or moreadditional nodes in the communication network, wherein the at least onetap point comprises at least a first tap point and a second tap point,the first tap point and the second tap point corresponding to first andsecond network nodes of the additional nodes, wherein the first tappoint includes a first tap location at an ingress side of the firstnetwork node and a second tap location at an egress side of the firstnetwork node, and the second tap point includes a third tap location atan ingress side of the second network node and a fourth tap location atan egress side of the second network node; detect one or moretransactions at the at least one tap point corresponding to the networkinterface, each transaction including request data and response data;classify each transaction detected at the respective at least one tappoint as an ingress or egress transaction relative to the node thatcorresponds to the tap point; determine a time associated with therequest data and a time associated with the response data for eachtransaction as classified; determine a delay time for each transactionas classified for each of the ingress and egress side of the at leastone tap point by a difference between the time associated with therequest data and the time associated with the response data; assign thedelay time for each transaction as classified, for each of the ingressand egress side of the at least one tap point to one or more predefinedtime ranges; increment a count corresponding to the one or morepredefined time ranges when the delay time is assigned; compare thedelay time for each transaction as classified at the first tap point tothe delay time for each transaction as classified at the second tappoint; determine based on the comparison, that a particular network nodeof the first and second network nodes has an issue associated with anexcessive delay; and indicate the issue to a network operator,responsive to detecting the issue.